CVE-2017-3204 — X Crypto vulnerability

CWE-31011 documents7 sources
Severity
8.1HIGHNVD
EPSS
0.5%
top 36.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Golang.org X CryptoGolang CryptoGO SSH Library
Timeline
PublishedApr 4
Latest updateFeb 7

Description

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶Gogolang.org/x_crypto< 0.0.0-20170330155735-e4e2799dd7aa
▶NVDgolang/crypto2017-03-17
▶CVEListV5go/ssh_libraryprior to commit e4e2799

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
golang.org/x/crypto/ssh Man-in-the-Middle attack↗2023-02-07
▶
GHSA
golang.org/x/crypto/ssh Man-in-the-Middle attack↗2023-02-07
▶
OSV
Man-in-the-middle attack in golang.org/x/crypto/ssh↗2021-04-14
▶
CVEList
CVE-2017-3204: The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks↗2017-04-04
▶
OSV
CVE-2017-3204: The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks↗2017-04-04
▶

📋Vendor Advisories

2
Red Hat
golang-googlecode-go-crypto: Go SSH library does not verify host keys by default↗2017-03-29
▶
Debian
CVE-2017-3204: golang-go.crypto - The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilita...↗2017
▶

💬Community

3
Bugzilla
CVE-2017-3204 golang-googlecode-go-crypto: Go SSH library does not verify host keys by default↗2017-04-06
▶
Bugzilla
CVE-2017-3204 golang-googlecode-go-crypto: Go SSH library does not verify host keys by default [fedora-all]↗2017-04-06
▶
Bugzilla
CVE-2017-3204 golang-googlecode-go-crypto: Go SSH library does not verify host keys by default [epel-6]↗2017-04-06
▶
CVE-2017-3204 — Golang.org X Crypto vulnerability | cvebase